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REMARKS 

Applicant has amended the description to correct 
typographical errors and to properly reflect the status of the 
U.S. Patent Application cited therein. 

Claims 1, 10 have been amended to incorporate the features 
of Claims 3, 11, which accordingly have been canceled without 
prejudice. Further support for the amendments of Claims 1 and 
10 appears in the specification at least at page 27, line 23 to 
page 31, line 8 and in FIGS. 4, 5, and 6. 

Claims 4, 6 have been amended for consistency with Claim 
1. Claim 21 has been amended to depend from Claim 1 and to 
correct an obvious typographical error. 

New Claims 23-26 have been added. Support for Claims 23- 
26 appears in the specification at least at page 15, line 16 to 
page 16, line 9; page 27, line 23 to page 31, line 8; and in 
FIGS . 4 , 5, and 6 . 

Claims 1-2, 4-10, 12-22 are novel over Curtis et al . 
(6,208, 720) . " 

Claim 1 has been amended to incorporate the features of 
Claim 3. Accordingly, the rejection of Claim 3 shall be 
discussed as applied to amended Claim 1. 

The Examiner states : 

Regarding Claim 3, 11, Curtis discloses the incident 
ticket for each incident having description of 
incident, a conclusion based on the incident, any 
actions responsive to the conclusion, a detail of the 
alert indications associated with the incident, 
tracking rules which identify one or more alert 
indications see Col 25 Ln 48-59 & Col 24 Ln 28-41 & Col 
18, Ln 45-59. (Office Action, page 3, emphasis added.) 
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Regarding the w tracking rules" asserted by the Examiner, 
Curtis et al . teaches that the alarms are filtered and 
correlated by analysis layer 133. 

Specifically, Curtis et al . teaches: 
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Alarms which are generated by the detection layer 
123 are sent to the analysis layer 133. Analysis layer 
133 analyzes alarm data and correlates different alarms 
which were generated from the same or related events 
and consolidates these alarms into fraud cases. ... In 
a preferred embodiment, analysis layer 133 includes a 
software component 134 which performs the 
consolidation, correlation, and reduction functions. 
Software component 134 uses external data from billing 
and AR systems 13 6 in the correlation and reduction 
processes. Preferably, alarm database 138 resides on 
the same hardware as software component 134. (Col. 10, 
lines 32-62, emphasis added.) 

Thus, Curtis et al . teaches that a software component 134 
of analysis layer 133 uses external data from the billing and 
AR system 136 in the filtering and correlating of alarms. 
Accordingly, the Examiner has failed to callout where Curtis 
et al . teaches or suggests that an incident ticket is 
displayed, the incident ticket itself including tracking rules 
that are editable by a user viewing the incident ticket. 
Further, since Curtis et al . teaches that external data from 
the billing and AR system 136 is used in the filtering and 
correlating of alarms, Curtis et al . actually teaches away 
from an incident ticket that itself including tracking rules 
that are editable by a user viewing the incident ticket. 

For at least the above reasons, Curtis et al . does not 
teach or suggest : 
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A method of declaring an incident in an 
enterprise comprising : 

providing a number of alert indications 
containing information concerning an incident related 
to the enterprise; and either 

comparing one or more of the alert indications to 
a set of rules, and if a match occurs between the set 
of rules, and the alert indication, declaring an 
incident based on the match, or 

comparing one or more of the alert indications to 
a decision table containing a number of defined alert 
events; remembering each alert indication that matches 
one of the defined alert events, comparing the 
remembered alert indication to correlation data in the 
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decision table, and if a match occurs between the 
remembered alert indication and the correlation data, 
declaring an incident based on the match; or 

if no match occurs between the alert indication 
and the correlation data or the rules set, declare an 
incident if the alert indication meets a defined 
default threshold value; and 

displaying an incident ticket for each incident 
declared, the incident ticket including a description 
of the incident, a conclusion based on the incident 
description, any actions responsive to the conclusion, 
one or more user-editable incident tracking rules 
which identify one or more further alert indications 
for association with the incident ticket, and a detail 
of the alert indications associated with the incident, 

as recited in amended Claim 1, emphasis added. Accordingly, 
Claim 1 is allowable over Curtis et al . Claims 2, 4-9, 21-22, 
which depend from Claim 1, are allowable for at least the same 
reasons as Claim 1 . 

Claim 10, and new Claim 23, are allowable for reasons 
similar to Claim 1. Claims 12-20, which depend from Claim 10, 
are allowable for at least the same reasons as Claim 10. 
Claims 24-26, which depend from Claim 23, are allowable for at 
least the same reasons as Claim 23. 

For the above reasons, Applicant respectfully requests 
reconsideration and withdrawal of this rejection. 



Conclusion 

Claims 1-2, 4-10, 12-26 are pending in the application. 
For the foregoing reasons, Applicant respectfully requests 
allowance of all pending claims. If the Examiner has any 
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questions relating to the above, the Examiner is respectfully 
requested to telephone the undersigned Attorney for 
Applicant (s) . 



CERTIFICATE OF MAILING 

I hereby certify that this correspondence is being deposited with the 
United States Postal Service with sufficient postage as first class mail 
in an envelope addressed to: Commissioner for Patents, P.O. Box 
1450flAlexandria, VA 22/fc/}450 } on January 27, 2006. 



Respectfully submitted, 
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Amendments to the Drawings: 

The attached five replacement sheets of drawings correct 
minor informalities and generally conform to USPTO drawing 
guidelines. Further, FIG. 2 on the first replacement sheet has 
been amended to add the reference number 55 and associated 
leadline near the upper center right of FIG. 2. This amendment 
is to secure correspondence with the specification at page 2, 
lines 6-8. 

Sheet one, which includes FIGS. 1 and 2, replaces the 
original sheet one including FIGS. 1 and 2. 

Sheet two, which includes FIG. 3, replaces the original 
sheet two including FIG. 3. 

Sheet three, which includes FIG. 4, replaces the original 
sheet three including FIG. 4. 

Sheet four, which includes FIG. 5, replaces the original 
sheet four including FIG. 5. 

Sheet five, which includes FIG. 6, replaces the original 
sheet five including FIG. 6. 

Attachment: Five Replacement Sheets 
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